PUT _template/loggingtemplate
{
      "order": 0,
      "template": "logging*",
      "settings": {
         "index.query.default_field": "Message",
         "index.refresh_interval": "5s",
         "index.number_of_replicas": "0",
         "index.number_of_shards": "1",
         "index.auto_expand_replicas": "false"
      },
      "mappings": {
         "logentry": {
            "_source": {
               "compress": false
            },
            "dynamic_templates": [
               {
                  "payload_template": {
                     "mapping": {
                        "index": "not_analyzed",
                        "type": "string"
                     },
                     "match": "Payload.*"
                  }
               }
            ],
            "properties": {
               "ProviderId": {
                  "index": "not_analyzed",
                  "type": "string"
               },
               "EventDate": {
                  "format": "dateOptionalTime",
                  "type": "date"
               },
               "Task": {
                  "index": "not_analyzed",
                  "type": "integer"
               },
               "Keywords": {
                  "index": "not_analyzed",
                  "type": "long"
               },
               "Message": {
                  "analyzer": "whitespace",
                  "type": "string"
               },
               "ActivityId": {
                  "index": "not_analyzed",
                  "type": "string"
               },
               "Opcode": {
                  "index": "not_analyzed",
                  "type": "integer"
               },
               "InstanceName": {
                  "index": "not_analyzed",
                  "type": "string"
               },
               "ProviderName": {
                  "index": "not_analyzed",
                  "type": "string"
               },
               "Version": {
                  "index": "not_analyzed",
                  "type": "integer"
               },
               "EventId": {
                  "index": "not_analyzed",
                  "type": "integer"
               },
               "Payload": {
                  "path": "full",
                  "dynamic": true,
                  "type": "object"
               },
               "Level": {
                  "index": "not_analyzed",
                  "type": "integer"
               },
               "RelatedActivityId": {
                  "index": "not_analyzed",
                  "type": "string"
               }
            },
            "_all": {
               "enabled": false
            }
         }
      },
      "aliases": {}
   }
}